Sessions expire in 1 week, add note to API.md